Low- Cost Chip Microprobing

Transcription

1 Low- Cost Chip Microprobing Philipp Maier Karsten Nohl SRLabs Template v11

2 A few smart cards chips cover numerous security domains Security chip applica.ons Payment cards, electronic ID cards, access badges Trusted plalorm modules (TPM) Device and accessory idenoficaoon SIM cards, NFC secure elements Content protecoon Chip hacking mo.va.on Recent trend FuncOonality that users tradioonally circumvented or exposed in their devices moves into hardware: Usage restricoons DRM, Dongeling Secret protocols Devices are increasingly controlled by their manufac- turer, not their owner We need more wide- spread hardware analysis knowledge and cheaper tools to combat this trend 2

3 Reverse- engineering hardware funcoons requires specific tools Disassamler, decompiler Oscilloscope, logic analyzer Microscope, microposi-.oner (this talk s focus) 3

4 This talk introduces the methodology and tools of earlier (and hopefully future) works Reverse- engineer chip func.onality Read out memories Introductory Deep Silicon Analysis Starbug, Nohl 25C3, HAR 2009 This Talk Dexter, Nohl 29C3 Reviving Smart Card Analysis Tarnovsky, Nohl Camp 2011, BlackHat 2011 Advanced Mifare, Legic, DECT Reversing Starbug, Plötz, dedected *, Nohl 24C3, 26C3 Hacking the Smart Card Chip et al. Tarnovsky Various BlackHat, ToorCon * dedected team: Karsten Nohl, Andreas Schuler, Erik Tews, Ralf- Philipp Weinmann, Mathias Wenzel 4

5 Microprobing background Probing with simple tools Advanced probing techniques 5

6 Basic CPU principle: Current instrucoon decides which instrucoon gets loaded next Program memory: (EEP)ROM, Flash CPU Core Instruc.on latch For most instrucoons: Program counter ++ Data For flow- altering instrucoons (branches, jumps, returns): Register / memory Program counter Address 6

7 Probing and glitching with only two needles allows full memory read- out Alacker goal: Make the CPU go to all places in memory independent of security checks and other flow characterisocs. This alack is called Linear Code Extrac.on. Instruc.ons, data Instruc.ons latch CPU logic with program counter Memory address Alacker probes one bus bit at a Ome (first needle) Alack vector 2: Overwrite one bit that is set for all flow- altering instrucoon (works on ARM and a few other instrucoon sets) Clock Alack vector 1: Freeze the latch clock so that one instrucoon is executed indefinitely (second needle) 7

8 Microprobing background Probing with simple tools Advanced probing techniques 8

9 Basic probing setup Buffer Needle Chip target MicroposiOoner Moveable stage 9

10 Step 1: Decapsulate chip OpOon A Mechanically pry open package OpOon B Chemically etch into package 10

11 Step 2: Expose wires (1/2) OpOon A Scratching A microposiooner in combinaoon with hard needles can break the silicon oxide (aka glass) above metal tracks Works best for highest ( top ) metal layer on non- planarized chips 11

12 Step 2: Expose wires (2/2) OpOon B Lasering A laser shot through the microscope destroys chip structures to: Expose wires for probing - or- Cut wires to alter chip logic; i.e. permanently reset lock bit OpOmal for planarized chips and for working on top metal Takes pracoce to not destroy chips through shorong wires or inducing overvoltage Higher cost alternaove when compared to scratching but more reliable aser pracoce 12

13 Step 3: Find exploitable wires Most interesong chip structures: Security bits (fuses) Data buses Discover them: Reverse- engineer (HAR 09, Camp 11) Trial and error EPROM Addressing Fuses Fuse output Source: Chris Tarnovsky, Flylogic (fuse image) 13

14 Step 4: Connect to wires with probing needle 14

15 Some level of probing can even be done with simple opocal microscopes and few extra components Old opocal microscope Micro- posiooner Drawback: Probe distance limited to 2mm Compare to 2cm w/ special probing microscope Stage 300 Measurement amplifier parts: 70 (design to be released under CC soon) parts: 50 15

16 Microprobing background Probing with simple tools Advanced probing techniques 16

17 Focused Ion Beams prepare small feature- size chips for probing Focus Ion Beam (FIB) operaoon mode 1: Cut into chip to expose structures FIB operaoon mode 2: Deposit material to allow probing connecovity to hidden/small wires Source: Chris Tarnovsky, Flylogic 17

18 ProtecOon meshes create addioonal complexity for FIB probing Protec.on meshes Tight metal trace on top layer hides criocal structures Mesh breach triggers alarm Source: Chris Tarnovsky, Flylogic 18

19 Meshes slow down alack, but do not prevent them Mesh circumven.on Either remove parts of mesh, then bridge/fix the mesh with FIB edits - or- Circumvent mesh alarm: If defense is bulk- erase of non- volaole memory: Cut off the programming pumps If chip it is logic reset: Exploit in the small Ome window before the reset triggers Source: Chris Tarnovsky, Flylogic 19

20 Arms race around front- side FIB alacks makes back- side alacks more alracove Invasive alacks and defenses have thus far concentrated on touching metal tracks on the chip The same criocal data can also be intercepted or manipulated at transistors, which are reachable from the other side of the chip Source: Oliver Kömmerling 20

21 Take aways Device funcoonality is increasingly hidden in hardware and needs to be freed Sosware can be extracted from chips using fuse overwrites or linear code extracoon Simple controllers can be alacked with cheap tools; smart cards require focused ion beams QuesOons? Philipp Maier Karsten Nohl 21